Skip to content
JAENES
SSLeak confirmedSeptember 16, 2026 announced

Helpfeel（Gyazo）Data breach / unauthorized access incident

笹尾 祐太朗の写真Reviewed by Yutaro SasaoWritten by Leak Watch editorial team published ・ updated
Occurred on
September 11, 2026
Announced on
September 16, 2026
Severity
SSLarge-scale compromise of sensitive data such as payment or identity-verification records affecting millions.
Scale
23,620,000 records
Main impact
Approximately 23,620,000 user records (anonymous ~18,010,000; registered with email ~5,620,000) and image metadata totaling about 490,000,000 + 2,400,000 + deleted ~174,000,000 were leaked, potentially including email addresses, password hashes, session IDs and other authentication data, as well as OCR text from images, geolocation, IPs and other metadata. About 23,620,000 user records from services including Gyazo were exposed, containing password hashes, authentication tokens, image OCR strings, location data, etc.; compensation, damages, and recovery costs were not disclosed.
Information involved
Email addressFull namePasswordUser / member IDAuth tokenHome address
Cause / key point
External attack exploiting a vulnerability in the image upload server that allowed arbitrary command execution (vulnerability exploitation). Unauthorized access is reported to have led to the disclosure of authentication credentials and image metadata.About Exploitation of vulnerabilities
Industry
IT & telecom
Sources
Last updated
October 21, 2026
Email addressFull namePasswordUser / member IDAuth tokenHome addressHow severity is assessed →

Is this incident worth paying attention to?

Written & reviewed

笹尾 祐太朗の写真

Reviewed byYutaro SasaoFounder & CEO, MediaLeap Inc.

CEO of MediaLeap Inc. Working on both sides of web advertising and web media since 2013; founded the company in May 2025.

Review scope: cross-checking against primary sources (official and government announcements), verifying claims stay within the facts, and checking source attribution。Last reviewed:

Written by:Leak Watch editorial team (AI-assisted drafts verified against sources by the editorial team) · Reviewer profile · Request a correction

Related incidents

Browse the database →

Incidents sharing the same company, service, attack method or industry (grouped automatically from the disclosures).

Same attack method

Same industry

Attack method classification: Exploitation of vulnerabilities(Breaking in through holes in software and devices)

Read the Exploitation of vulnerabilities guide and national trends →

← Back to Breach Watch